Feather Privacy Policy

Last updated: 2026-10-25

Controller: GaiaHex Ltd

Privacy questions and requests: support@gaiahex.com or our privacy request page.

Public policy address: https://feather-legal.pages.dev/privacy/

1. About this policy

Feather helps you work toward stopping smoking through a personal diary, progress tools, educational reading, games and SOS exercises. This policy explains what stays on your device, what can reach another organisation, and your choices. Our Terms describe use of the service.

The launch app does not offer an app account, a cloud diary or an AI coach. A store account used for subscriptions belongs to Apple or Google. Optional service providers may still receive identifiers and events without an app account.

2. Your diary and other local information

Depending on the features you use, the app can save:

• Smoking history, cigarette quantities and costs, quit dates, attempts, cravings and slips; triggers, moods, notes and place labels; replacement-product entries; and answers about health risks or smoking habits.
• Optional profile details such as your name, birthday, gender and pregnancy-related answers.
• Goals, savings calculations, personal reasons and plans, story text, Journey progress, saved reading, feedback choices and game progress.
• Reminder schedules, appearance and privacy settings, and some unfinished onboarding or check-in answers.

These records can reveal sensitive information about your health. App code stores them locally rather than sending diary content to our own server. Consent-based events described below can reveal that you used a craving or SOS feature, even though they contain no diary entry.

Local records are saved as ordinary app data, without encryption added by this app. The operating system provides its own sandbox and device protections. On the web, saved state uses browser storage. Someone with access to your unlocked device or backups may be able to access your information. Device backup, restore and migration settings may copy app data to Apple, Google or another backup destination; removing the app does not necessarily remove those copies. Android backup is configured to include the app database, app-owned photos and earlier recordings. The database also holds saved consent, campaign information and the random analytics identity. Separate native SDK preferences and event caches are outside the Android backup allowlist. Modern Android cloud backup is configured to require encryption capability; older transports and device transfers have different rules. These settings do not guarantee a successful backup or restore, and do not configure iOS backup.

3. Photos, earlier recordings, places and maps

Photos are optional. Choosing a photo or taking one in the app saves a copy in the app's files. Camera and library access use platform permissions or the selected-photo picker. The app does not automatically upload these photos. Removing an app copy leaves the original in your photo library alone.

Voice recording and playback are disabled for launch. You can still write personal reasons and attach photos. Recordings from an earlier version can remain in local app data, but this release does not play them or automatically erase them. There is no app-written upload of these recordings.

If a reason already has a recording, its editor lets you remove the attachment and save the change. Deleting the reason also starts cleanup. The app attempts to delete the private voice file once no saved reason or open reason draft references it; discarding an edit preserves the saved attachment. Individual cleanup failures are not reported. Delete data also attempts to remove referenced voice files; section 9 explains its limits.

If you allow location access, the app can obtain a foreground location fix and save it with a craving. When permission has already been granted, a new craving can receive a location automatically. There is no continuous background location tracking. Converting coordinates into a place label uses the operating system's geocoder, which may send coordinates to its provider.

Native maps can use Apple Maps on iOS or Google Maps on a configured Android build. Displaying a map can disclose connection information and the viewed area to that provider. The map uses saved places rather than following your live position. Web and Android builds without a map key use an offline display. Camera and location permissions can be withdrawn in device settings without erasing earlier entries. The native configuration still includes microphone permission for the dormant recording implementation; the disabled launch controls do not request it. Any microphone access granted earlier can also be withdrawn in device settings. Withdrawing permission does not delete a saved recording.

4. Reminders on your device

With notification permission and the relevant choices enabled, the app schedules local reminders. These cover support times, Journey steps, progress milestones, achievements, goals, later check-ins and support after a slip. It can also schedule onboarding recovery and trial-end reminders when their conditions apply. The app does not register a remote push token or send these schedules to an app notification server. The Android notification library includes Firebase Messaging transport; local scheduling alone does not establish whether that underlying transport contacts a platform service.

Lock-screen text may reveal smoking-related progress or a support label you entered. Use the app's reminder controls and device notification settings to choose what appears. The operating system may delay or suppress alerts, and limits how many can be queued. A trial reminder is a convenience, not a reliable cancellation deadline.

5. Optional measurement and crash reporting

Optional analytics starts off. Saved consent is required before the app starts its analytics and crash adapters. Leaving a consent screen without saving agreement does not enable them. The app does not keep an earlier activity history to upload after you agree.

The current Privacy, App Tracking and statistics consent screens save analytics and advertising attribution together. They do not offer separate choices for those purposes. Where configured, agreeing therefore enables the optional services below; review the Android advertising disclosure before choosing. You can change the saved choice in the privacy controls. Missing provider keys, unsupported platforms or test-only sessions can prevent an integration from running even after agreement.

The app does not attach diary notes, names, smoking quantities, craving strength, mood, quiz answers, precise coordinates, photos or recordings to these events. PostHog automatic click capture, session replay and device-property enrichment are disabled; IP-based geographic enrichment is also disabled. Sentry screenshots, replay, profiling and automatic session reporting are disabled. Providers still receive the connection's IP address, and native SDK behavior requires release-device verification.

Android advertising measurement through Meta

When configured on Android, Meta receives optional advertising measurements after both saved consents. Events cover app activation/opening, onboarding completion, trial starts and purchases or subscriptions. App-supplied purchase parameters are limited to an available offered price and currency; these events do not prove an actual charge or renewal. The app does not send diary contents or screen-by-screen activity to Meta.

Meta's SDK can add its own app/device identifier, available Android advertising and Facebook attribution identifiers, install/referrer information and technical context such as app version, device model, locale and network IP. Its native referrer handling is separate from the restricted PostHog receipt above. This processing supports advertising measurement across companies, so a general promise that all recipients act only as our processors would be inaccurate. Meta is not enabled on iOS or web in the reviewed code; there is no iOS advertising-ID or App Tracking Transparency flow.

What happens when you withdraw consent

The app stops creating optional events. PostHog's unsent memory queue and local identifier are cleared, and pending requests are aborted where possible. Agreeing later creates a new local analytics identity. Local campaign values are cleared, but an Android once-per-install marker remains.

Sentry is closed. Meta's advertiser-ID collection and new app-originated calls are disabled and our pending work is dropped. Meta has no supported full shutdown or cache-erasure operation: submitted work cannot be recalled, configuration activity can continue during that process, and previously consented cached events can remain for a later consented upload. Closing Sentry is not a guarantee that every native queued report is erased. Withdrawal does not erase records already received by any provider. Use our privacy request page for help with those records; fulfilling a request depends on the information and identifiers that can be located.

6. Subscriptions and payments

Apple or Google processes store payments and holds your payment credentials. The app does not receive your card number. If enabled in the release, Superwall provides paywalls and purchase/restore integration. It can process subscription status and purchase history, pseudonymous app/vendor identifiers, device/app context, paywall activity and IP-related geography. The app also keeps a local access-status cache.

Billing and configuration requests needed to show offers or establish access are separate from optional analytics. App code sets Superwall optional event tracking to off until analytics consent and updates that setting when your choice changes. It disables external-data collection and forwarding identifiers to Google Play through the available SDK options. Those settings do not mean that the billing service makes no network requests or holds no purchase records. App-supplied placement parameters exclude diary text and return-route query values.

7. Sharing and contacting support

Sharing an achievement or certificate creates an image for the operating system's share sheet. You choose the recipient. The image may contain a name or progress information; check it before sharing. A cached image can remain so the receiving app can read it. Recipients control the copies they receive. Web downloads and any later sharing are under your control.

The app can open an email draft to support@gaiahex.com in your mail app; it does not send it automatically. If no mail app can open the draft, the app reports the failure. You can also use the Feather contact page. Your email provider and our support provider receive what you choose to send, including your address, message and attachments. A support link can include an app identifier if one is supplied. Avoid sending diary details you do not want included in correspondence.

8. Purposes, legal grounds and recipients

Local processing provides the features you request. Billing providers and stores help deliver paid access and handle purchases. Optional analytics helps us understand use and investigate errors; optional Android attribution measures campaigns. Support correspondence lets us answer your request. Where the law requires it, information may also be processed to meet legal duties or address a legal claim.

Optional measurement relies on the saved choice described in section 5; you can withdraw it there. A location or photo permission controls device access to that feature, rather than authorising advertising. Requested paid access requires billing and store processing even when optional measurement is off. The app's local diary is separate from those provider records. An analytics choice is not a separate consent to upload health records.

Recipients include the named measurement and billing providers, Apple or Google platform services, providers handling a message you send to us, and recipients you choose when sharing. We may disclose information where required by law. Meta advertising measurement involves another company's advertising services; this policy does not describe it as exclusively processing on our behalf or promise that no advertising sharing occurs.

Providers may process information outside your country. Their linked privacy notices explain their international operations and protections. Contact us about a particular recipient or transfer. This policy does not claim that every provider uses the same country, contractual role or retention period.

9. Retention and deleting local data

Local information stays in the app's saved data until it is removed. Restarting a quit attempt can preserve a snapshot of earlier entries; deleting an entry from the current diary does not necessarily remove that history. Delete data resets app state and attempts to delete referenced app-owned photos and voice files. If file deletion fails, the app reports a failure. The reset is saved through the app's persistence mechanism; it is not a forensic or secure-wipe guarantee.

This action does not cancel a subscription, delete a store account, recall shared images or emails, clear an original photo from your library, or request deletion from providers. Unreferenced files, shared-image caches, native SDK preferences/caches and operating-system backups are not guaranteed to be erased. Reinstalling or restoring a backup may restore information. There is no app-account or server-diary deletion service in the reviewed app.

PostHog events and associated identities, Sentry crash reports, Superwall billing records and Meta measurement records can remain after an app reset or consent withdrawal. Their retention and deletion depend on the configured service and the provider's rules; there is no app-operated timer that erases all such records. Store transaction records follow Apple or Google rules, including applicable record-keeping duties. Support providers retain messages separately from app data. OS backup expiry is controlled by the backup service. We do not promise a fixed retention period or immediate removal from backups.

Use our privacy request page to ask about access or erasure of off-device records. Tell us which service or interaction your request concerns, but do not send payment credentials or a full diary. We may need further information to identify records. Because there is no Feather account and analytics uses random identifiers, we may be unable to associate some provider records with your request. We will explain any applicable technical or legal limits; local deletion alone does not fulfil a provider-data request.

10. Rights and policy updates

Your local entries can be edited or removed through the app. You can withdraw optional measurement in the privacy controls and change device permissions in system settings. For information held off-device, contact us through the privacy request page.

Depending on the law that applies to you, rights may include access, correction, erasure, portability, restriction, objection or withdrawal of consent. Advertising-related choices and complaint or appeal rights also depend on your location and the processing concerned. A request can be subject to identity checks, available identifiers and lawful exceptions. You may contact the privacy regulator responsible for your location. This policy does not limit rights that applicable law provides.

We will date changes here and provide any notice or renewed choice required for a material change.